{"id":"CVE-2026-105606","kind":"vulnerability","aliases":["CVE-2026-105606"],"related":[],"title":"Joomla Custom Tables extension: unauthenticated file upload to web-accessible directory","description":"Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.","summary":"The Custom Tables extension for Joomla lets an anonymous visitor upload a file with an attacker-chosen extension to a publicly served temporary folder, and the response reveals where it was stored. An attacker can use this to host phishing or malware pages under the victim site's domain.","severity":"critical","cvss":9.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["custom-tables","joomla","other","php","self-hosted"],"not_affected_if":["extension-not-installed","no-public-submission-form","version-3.7.8-or-later"],"how_to_check":"- Check the installed Custom Tables extension version in the Joomla administrator under Extensions > Manage (unknown if the sources do not say where it is listed)\n- Check whether the site has a public Custom Tables submission form (unknown if the sources do not say how to find it)","fix":"- Custom Tables: move to `3.7.8` or later","status":"open","published_at":"2026-11-02T19:17:50+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:32+00:00","updated_at":"2026-11-02T19:26:32+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T19:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- Custom Tables: move to `3.7.8` or later","reach":"internet","title":"Joomla Custom Tables extension: unauthenticated file upload to web-accessible directory","impact":"medium","summary":"The Custom Tables extension for Joomla lets an anonymous visitor upload a file with an attacker-chosen extension to a publicly served temporary folder, and the response reveals where it was stored. An attacker can use this to host phishing or malware pages under the victim site's domain.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","custom-tables","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker hosts phishing or malware pages on the victim's domain","analyst_note":"Confirm the affected version range and whether the upload path requires a public submission form, using the NVD entry and the extension vendor's advisory.","how_to_check":"- Check the installed Custom Tables extension version in the Joomla administrator under Extensions > Manage (unknown if the sources do not say where it is listed)\n- Check whether the site has a public Custom Tables submission form (unknown if the sources do not say how to find it)","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed","no-public-submission-form","version-3.7.8-or-later"],"who_is_affected":"Joomla sites that run the Custom Tables extension below `3.7.8` and expose a public Custom Tables submission form are exposed. Sites without that extension or without a public submission form are not described by the sources as affected. Only the default static-serving behaviour is described; other configurations are unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":4245,"output_tokens":609,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-105606':15A,18A '-2026':14A,17A '3.7.8':88C 'access':11A,107C,155C 'allow':158C 'anonym':36B 'arbitrari':82C,148C 'attack':44B,62B,91C,100C,162C 'attacker-chosen':43B 'attacker-control':99C,161C 'chosen':45B 'content':140C,164C 'control':101C,163C 'custom':2A,20B,29B,86C,118C 'custom-t':19B 'cve':13A,16A 'default':132C 'directori':12A,109C,156C 'disclos':127C 'domain':77B,175C 'exampl':166C 'expos':115C 'extens':4A,31B,46B,79C,102C 'file':6A,40B,83C,96C,135C,149C 'folder':52B 'form':121C 'host':27B,67B,159C 'impact':144C 'joomla':1A,22B,33B,78C,112C 'joomlaboat.com':80C 'let':34B 'malwar':70B,169C 'page':71B,170C 'path':125C 'phish':68B,167C 'php':24B 'polyglot':95C 'primari':143C 'public':49B,117C 'respons':55B,130C 'reveal':56B 'self':26B 'self-host':25B 'serv':50B,137C 'site':75B,113C 'static':139C 'store':60B,124C 'submiss':120C 'tabl':3A,21B,30B,87C,119C 'temporari':51B 'tmp':108C 'unauthent':5A,81C,90C,147C 'upload':7A,38B,84C,93C,134C 'use':64B 'victim':74B,173C 'visitor':37B 'web':10A,106C,154C 'web-access':9A,105C,153C 'write':150C","nicknames":[],"mitigations":[],"who_affected":"Joomla sites that run the Custom Tables extension below `3.7.8` and expose a public Custom Tables submission form are exposed. Sites without that extension or without a public submission form are not described by the sources as affected. Only the default static-serving behaviour is described; other configurations are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","customtables","joomla","other","php","selfhosted"],"first_public_at":"2026-11-02T19:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105606","severity":null,"published_at":"2026-11-02T19:17:50+00:00","modified_at":"2026-11-02T19:17:50+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}